<p dir="ltr"><br>
On Feb 6, 2014 3:42 PM, "C. L. Martinez" <<a href="mailto:carlopmart@gmail.com">carlopmart@gmail.com</a>> wrote:<br>
><br>
> Hi all,<br>
><br>
> Is it possible to add multiple rewrite conditions in syslog-ng 3.4.x like this:<br>
><br>
> rewrite r_rewrite_set{<br>
> set("myhost1", value("HOST")<br>
> condition(program("myapplication1")));<br>
> set("myhost2", value("HOST")<br>
> condition(program("myapplication2")));<br>
> set("myhost3", value("HOST")<br>
> condition(program("myapplication3")));<br>
> set("myhost4", value("HOST")<br>
> condition(program("myapplication4")));<br>
> };<br>
></p>
<p dir="ltr">Well, this would sequentially evaluate the filters, and then apply the rewrite rule which matches.</p>
<p dir="ltr">If this is the only thing you want to change based on the program filter, then it should be ok.</p>
<p dir="ltr">If you have or will have more rewrites using the same condition, I'd use the junction syntax instead.</p>
<p dir="ltr">Junction {<br>
Log {<br>
Filter { program(...); };<br>
Rewrite {}<br>
Flags(final);<br>
}<br>
Log {};<br>
...<br>
}</p>
<p dir="ltr">This should break out at the first match, instead of trying to match all.</p>
<p dir="ltr">What's more this whole junction block can be created as a rewrite rule, and then referenced in multiple logpaths.</p>
<p dir="ltr">> ??<br>
><br>
> Is this a good option or maybe a performance penalty??<br>
><br>
> Thanks.<br>
> ______________________________________________________________________________<br>
> Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
> Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
> FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
><br>
</p>